Privacy Policy
Last updated: 7 September 2026
Before you publish: this is a working draft written to a sensible standard, not legal advice. Have a Cyprus-qualified lawyer review it and fill in the placeholders marked TBC — company registration number, registered address, and your Data Protection Commissioner details.
Who we are
Vista Estates (“we”, “us”) is a property management business operating in the Republic of Cyprus. For the purposes of the EU General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018, we are the data controller for the personal data described below.
Registered office: TBC, Limassol, Cyprus. Company registration number: TBC. You can reach us at hello@vistaestates.cy.
What we collect
- Enquiry details — the name, email address, telephone number, property location and message you submit through our contact form.
- Client and tenancy records — where you go on to become an owner or tenant client: identification documents, proof of address, bank details for rent transfers, references, and tenancy correspondence.
- Property information — addresses, title details, inspection photographs, maintenance history and utility accounts relating to properties we manage.
- Technical data — IP address, browser type and pages visited, collected only if and when analytics are enabled. See our Cookie Policy.
Why we use it, and on what legal basis
- To respond to your enquiry — on the basis of your consent, which you may withdraw at any time.
- To provide management services — on the basis of performing our contract with you.
- To meet legal obligations — including anti-money-laundering identification checks, tax reporting and stamping of tenancy agreements.
- To protect and improve the business — on the basis of our legitimate interests in securing our systems, preventing fraud and understanding how the site is used.
Who we share it with
We share personal data only where it is necessary: with contractors attending a property, with tenants or landlords as the tenancy requires, with our accountants and lawyers, with referencing and identity-verification providers, and with public authorities where the law requires it. We do not sell personal data, and we do not pass your details to third parties for their own marketing.
Some of our service providers process data outside the European Economic Area. Where that happens we rely on European Commission adequacy decisions or Standard Contractual Clauses.
How long we keep it
Enquiries that do not become clients are deleted within 24 months. Client and tenancy records are kept for the duration of the relationship and then for six years, which is the period we are required to retain financial and tax records in Cyprus. Identification documents collected for anti-money-laundering purposes are kept for five years after the relationship ends.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased where we no longer have grounds to keep it, to restrict or object to processing, and to receive your data in a portable format. To exercise any of these, email hello@vistaestates.cy. We will respond within one month.
If you are not satisfied with our response, you may complain to the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus.
Security
We hold personal data on access-controlled systems, use encrypted connections for this website, and limit access to staff who need it for their work. No system is perfect; if a breach occurs that is likely to affect your rights, we will notify you and the Commissioner as the law requires.
Changes to this policy
We may update this policy from time to time. The date at the top of the page always reflects the current version, and material changes will be flagged on our homepage.